Ticket #32616: 32616.2.patch

src/wp-includes/js/mce-view.js

@@ -732 +732 @@
  * and a view for embeddable URLs.
  */
 ( function( window, views, media, $ ) {
-        var base, gallery, av, embed;
+        var base, gallery, av, embed,
+                schema, parser, serializer;
+
+        function verifyHTML( string ) {
+                var settings = {};
+
+                if ( ! window.tinymce ) {
+                        return string.replace( /<[^>]+>/g, '' );
+                }
+
+                if ( ! string || ( string.indexOf( '<' ) === -1 && string.indexOf( '>' ) === -1 ) ) {
+                        return string;
+                }
+
+                schema = schema || new window.tinymce.html.Schema( settings );
+                parser = parser || new window.tinymce.html.DomParser( settings, schema );
+                serializer = serializer || new window.tinymce.html.Serializer( settings, schema );
+
+                return serializer.serialize( parser.parse( string, { forced_root_block: false } ) );
+        }
 
         base = {
                 state: [],
@@ -783 +802 @@
                                 } );
 
                                 self.render( self.template( {
+                                        verifyHTML: verifyHTML,
                                         attachments: attachments,
                                         columns: attrs.columns ? parseInt( attrs.columns, 10 ) : media.galleryDefaults.columns
                                 } ) );

src/wp-includes/media-template.php

@@ -1216 +1216 @@
                                                 </dt>
                                                 <# if ( attachment.caption ) { #>
                                                         <dd class="wp-caption-text gallery-caption">
-                                                                {{ attachment.caption }}
+                                                                {{{ data.verifyHTML( attachment.caption ) }}}
                                                         </dd>
                                                 <# } #>
                                         </dl>